PT-2024-21641 · Decidim · Decidim

Andreslucena · Published 2024-07-10 · Updated 2024-07-11 · CVE-2024-27090

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.27.6

Description Decidim is a participatory democracy framework, written in Ruby on Rails. If an attacker can infer the slug or URL of an unpublished or private resource, and this resource can be embedded, then some data of this resource could be accessed.

Recommendations For versions prior to 0.27.6, update to version 0.27.6 to resolve the issue. As a temporary workaround, consider disallowing access through your web server to the URLs finished with /embed.html until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-27090

GHSA-QCJ6-VXWX-4RQV

Affected Products

Decidim

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27090.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/decidim/CVE-2024-27090.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-27090 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27090 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qcj6-vxwx-4rqv · Vendor Advisory
• https://github.com/decidim/decidim · Note
• https://github.com/decidim/decidim/releases/tag/v0.27.6 · Note
• https://github.com/decidim/decidim/commit/1756fa639ef393ca8e8bb16221cab2e2e7875705 · Note
• https://github.com/decidim/decidim/pull/12528 · Note
• https://github.com/decidim/decidim/security/advisories/GHSA-qcj6-vxwx-4rqv · Note
• https://t.me/cvedetector/579 · Telegram Post
• https://twitter.com/CVEnew/status/1811322714038419810 · Twitter Post
• https://twitter.com/rubylandnews/status/1811510895417167911 · Twitter Post
• https://t.me/cvenotify/85711 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1811135127835037753 · Twitter Post